Category
9 posts
9 posts
Two small problems that cost me more time than they should have, an openvpn3 error about an invalid D-Bus path and an SSH connection that hung because of a stale ControlMaster socket, plus a recap of the whole series.
Every bug I hit while building my own VPN gateway, internal network and DNS, grouped by kind, with the symptom, the cause and the fix, and the three patterns behind most of them.
How my OpenVPN fallback on TCP 443 is configured, why tls-crypt made it stop answering scanners, how I build client profiles, and the steps for adding and revoking a client.
Building a new certificate authority for my OpenVPN fallback with easy-rsa, choosing validity periods, staging the files with strict permissions, and replacing 150 lines of inlined certificates with five directives.
Adding one phone to my OpenVPN fallback revealed that the private key of the old certificate authority no longer existed anywhere. How I searched for it, and the 30-second check that proves whether a certificate and a key belong together.
Why I split DNS into two layers, CoreDNS as the authority for my internal names and Pi-hole as the filtering resolver my devices use, and the settings that keep internal names from leaking.
Setting up WireGuard as the primary tunnel into my servers, with keys that never leave their machines, a split tunnel on the laptop through NetworkManager, and TTL values to prove the routing.
How I gave my virtual machines their own routed network across two Proxmox hosts, using isolated bridges, static routes and NAT, and how a missing NetworkManager option caused silent packet loss.
The first post in my Owning the Edge series. The VPN into my servers broke in three ways at once, so instead of repairing a box I did not control, I built my own gateway, internal network and DNS from scratch.